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EXAMINER' S ANSWER 



This is in response to the appeal brief filed 9/6/11 appealing from the Office action mailed on 
12/1/10. 
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(1) Real Party in Interest 

The examiner has no comment on the statement, or lack of statement, identifying by 
name the real party in interest in the brief. 

(2) Related Appeals and Interferences 

The following are the related appeals, interferences, and judicial proceedings known to 
the examiner which may be related to, directly affect or be directly affected by or have a bearing 
on the Board's decision in the pending appeal: 

11927477 and 12070164 

(3) Status of Claims 

The following is a list of claims that are rejected and pending in the application: 
Claims 1, 3-11, 13-17, 19-21 and 23-35 are rejected and pending in the application. 

(4) Status of Amendments After Final 

The examiner has no comment on the appellant's statement of the status of amendments 
after final rejection contained in the brief. 

(5) Summary of Claimed Subject Matter 

The examiner has no comment on the summary of claimed subject matter contained in 
the brief. 
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(6) Grounds of Rejection to be Reviewed on Appeal 

The examiner has no comment on the appellant's statement of the grounds of rejection to 
be reviewed on appeal. Every ground of rejection set forth in the Office action from which the 
appeal is taken (as modified by any advisory actions) is being maintained by the examiner except 
for the grounds of rejection (if any) listed under the subheading "WITHDRAWN 
REJECTIONS." New grounds of rejection (if any) are provided under the subheading "NEW 
GROUNDS OF REJECTION." 



(7) Claims Appendix 

The examiner has no comment on the copy of the appealed claims contained in the 
Appendix to the appellant's brief. 



(8) Evidence Relied Upon 

7,206,814 Kirsch 04-2007 

20080040439 Wang 02-2008 

7,366,761 Murray et al 04-2008 

20050076240 Appleman 04-2005 

2004/0068542 Lalonde et al 07-2006 
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(9) Grounds of Rejection 

Claim Rejections - 35 USC § 103 



1. Claims 1, 3, 5, 7-10, 13-17, 19, 28, 30-31 and 33-35 are rejected under 35 U.S.C. 103(a) 
as being unpatentable over Kirsch, US Patent 7,206,814 (hereinafter Kirsch) in view of Wang, 
US Patent Application Publication 2008/0040439 (hereinafter Wang). 

2. As per claims 1 and 35, Kirsch teaches the invention substantially as claimed, 
comprising: maintaining a reputation table in memory (i.e., list of information regarding the 
actual senders), the reputation table including information regarding a plurality of address- 
domain pairs(i.e., actual senders are identified by IP and domain pair), each of the plurality of 
address-domain pairs indicating an IP address and an associated domain of a previously received 
message (col. 3, lines 7-13; col. 9, lines 2—31; col. 11, lines 24-30; col. 16, lines 27-32), the 
information regarding each of the plurality of address-domain pairs including one or more 
classification variables (i.e., scores are ratio of classification variables) (col. 11, lines 24-60); 

receiving the message transmitted over the network (col. 4, line 66-col. 5, line 12); and 
executing instructions stored in a non-transitory computer readable storage medium to: 
determine an associated domain from which the received message is purported to be sent 

(col. 4, line 66-col. 5, line 12), 

identify that the determined domain appears on a whitelist (col. 4, line 66-col. 5, line 12), 
determine an IP address corresponding to a device from which the received message was 

relayed (col. 7, lines 35-37), 
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associate the determined domain with the IP address to create an address-domain pair for 
the received message (col. 6, lines 10-40); 

classify the received message based on a score assigned to the address-domain pair, the 
score comprising a ratio (col. 12, lines 12-13) of a first classification variable of the address- 
domain pair to a second classification variable of the address-domain pair as indicated by the 
reputation table (col. 11, lines 24-60), and 

override the whitelist based on the score assigned to the address-domain pair, wherein the 
received message is classified as spam even though the domain of the received message appears 
on the whitelist (col. 19, lines 7-14). 

3. Kirsch does not teach variable decaying with time. Wang teaches the one or more 
classification variables decaying with time ([0046], [0047] and claims 5 and 22). 

4. It would have been obvious to one having ordinary skill in the art at the time of the 
invention was made to combine the teachings of Kirsch and Wang because Wang's teaching of 
variables decaying with time would increase the security of their system by allowing their system 
to determine whether to accept or reject messages on the basis of the classification of the sender. 

5. As per claim 3, Kirsch and Wang teach the invention substantially as claimed in claim 1 
above. Kirsch further teach classifying the received message is further based on classification 
variables associated with another address-domain pair (i.e., classification based on range of IP 
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combined with certain domain name), the other address- domain pair having a related IP address 
or related domain (col. 2, lines 58-64; col. 6, line 59-col. 7, line 4). 

6. As per claim 5, Kirsch and Wang teach the invention substantially as claimed in claim 1 
above. Kirsch further teach wherein a plurality of IP addresses is associated with the domain 
(col. 2, lines 63-64). 

7. As per claim 7, Kirsch and Wang teach the invention substantially as claimed in claim 1 
above. Kirsch further teaches wherein the IP address is a boundary IP address (col. 7, line 30). 

8. As per claim 8, Kirsch and Wang teach the invention substantially as claimed in claim 1 
above. Kirsch further teach wherein the IP address is preconfigured (col. 4, line 66-col. 5, line 
6). 

9. As per claim 9, Kirsch and Wang teach the invention substantially as claimed in claim 1 
above. Although Kirsch teaches wherein the IP address is preconfigured (col. 4, line 66-col. 5, 
line 6), however, Kirsch and Wang do not specifically teaches including wherein the IP address 
is preconfigured to be one hop from a gateway IP address. It would have been obvious to one 
having ordinary skill in the art at the time of the invention was made to include IP address 
preconfigured to be one hop or any hop from a gateway IP address because by doing so it would 
increase the user control by allowing configuration according to the user's design choice. 
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10. As per claim 10, Kirsch and Wang teach the invention substantially as claimed in claim 1 
above. Kirsch further teach wherein the IP address is learned (col. 1, lines 24-25) (learned from 
the header). 

11. As per claim 13, Kirsch and Wang teach the invention substantially as claimed in claim 
10 above. Kirsch further teach wherein the IP address is a boundary IP address (col. 7, line 30) 
and wherein the boundary IP address is learned by detecting a pattern in a certain number of 
previously received messages (col. 7, lines 20-45). 

12. As per claim 14, Kirsch and Wang teach the invention substantially as claimed in claim 1 
above. Kirsch further teach wherein determining the domain from which the received message is 
purported to be sent includes identifying the stated sender domain associated with the received 
message (col. 7, lines 55-64). 

13. As per claim 15, Kirsch and Wang teach the invention substantially as claimed in claim 1 
above. Kirsch further teaches wherein the domain is a domain associated with a boundary IP 
address (col. 7, lines 30, 49-54). 

14. As per claim 16, Kirsch and Wang teach the invention substantially as claimed in claim 1 
above. Kirsch further teach wherein classifying the received message is further based on 
consulting a white list (col. 8, lines 31-38). 
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15. As per claim 17, Kirsch and Wang teach the invention substantially as claimed in claim 1 
above. Kirsch further teach wherein classifying the received message is further based on 
previous classifications made to the address-domain pair (col. 12, lines 1-30). 

16. As per claim 19, Kirsch and Wang teach the invention substantially as claimed in claim 1 
above. Kirsch further teach determining a spam ratio (col. 12, lines 12-14). 

17. As per claim 28, Kirsch and Wang teach the invention substantially as claimed in claim 1 
above. Kirsch further teaches providing the classification of the received message based on the 
address-domain pair as input to another classifier (col. 8, lines 17-62). 

18. As per claim 30, Kirsch and Wang teach the invention substantially as claimed in claim 1 
above. Kirsch further teach wherein classifying the received message is further based on a score 
assigned to the IP address (col. 12, lines 24-30). 

19. As per claim 31, Kirsch and Wang teach the invention substantially as claimed in claim 1 
above. Kirsch further teach wherein classifying the received message is further based on a score 
assigned to the domain (col. 12, lines 24-30). 

20. As per claim 33, Kirsch and Wang teach the invention substantially as claimed in claim 
30 above. Kirsch further teach comprising determining a score assigned to the IP address 
(Kirsch, col. 12, lines 1-30). 
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21 . As per claim 34, Kirsch and Wang teach the invention substantially as claimed in claim 
31 above. Kirsch further teach comprising determining a score assigned to the domain (Kirsch, 
col. 12, lines 1-30). 

22. Claims 4 and 32 rejected under 35 U.S.C. 103(a) as being unpatentable over Kirsch and 
Wang as applied to claim 1 above, and further in view of Lalonde et al, US Patent Application 
Publication 2004/0068542 (hereinafter Lalonde). 

23. As per claim 4, Kirsch and Wang teach the invention substantially as claimed in claim 1 
above. Kirsch and Wang do not the other message being associated with IP addresses other than 
the IP address of the message. Lalonde teaches wherein classifying the received message is 
further based on classifications of other messages associated with the domain of the received 
message (i.e., checking the blacklist) ([0042]), the other message further being associated with IP 
addresses other than the IP address of the received message ([0039]). 

24. It would have been obvious to one having ordinary skill in the art at the time of the 
invention was made to combine the teachings of Kirsch, Wang and Lalonde because Lalonde 's 
teaching of further classification of the message would increase the security of Kirsch's and 
Wang's systems by further indentifying associated information regarding a message in order to 
determine and to filter unwanted message. 
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25. As per claim 32, Kirsch and Wang teach the invention substantially as claimed in claim 1 
above. Although Kirsch teaches classifying the message based on a score assigned to the 
domain (col. 12, lines 24-30), however, Kirsch and Wang do not determining the received 
message was forged. Lalonde teaches wherein classifying includes classifying the message 
based on the domain and determining that the received message was forged ([0038]). 

26. It would have been obvious to one having ordinary skill in the art at the time of the 
invention was made to combine the teachings of Kirsch, Wang and Lalonde because Lalonde's 
teaching of further classification of the message would increase the security of Kirsch's and 
Wang's systems by further indentifying associated information regarding a message in order to 
determine and to filter unwanted message. 

27. Claims 6, 11, 20-21 and 23-27 rejected under 35 U.S.C. 103(a) as being unpatentable 
over Kirsch and Wang as applied to claim 1 above, and further in view of Murray et al, U.S. 
Patent 7,366761 (hereinafter Murray). 

28. As per claim 6, Kirsch and Wang teach the invention substantially as claimed in claim 1 
above. Kirsch and Wang do not teach the IP address is associated with a plurality of domains. 
Murray teaches wherein the IP address is associated with plurality of domains (col. 7, line 65- 
col. 8, line 4). 
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29. It would have been obvious to one having ordinary skill in the art at the time of the 
invention was made to combine the teachings of Lalonde, Kirsch, Wang and Murray because 
Murray's teaching of the IP address is associated with plurality of domains would increase the 
effectiveness of their system by allowing identification of the IP address is associated with the 
domain in order to filter unwanted e-mails based on sender information. 

30. As per claim 11, Kirsch and Wang teach the invention substantially as claimed in claim 1 
above. Kirsch and Wang do not teach including the IP address is adaptively determined. Murray 
teaches wherein the IP address is adaptively determined (col. 3, lines 25-27). 

31. It would have been obvious to one having ordinary skill in the art at the time of the 
invention was made to combine the teachings of Kirsch, Wang and Murray because Murray's 
teaching of the IP address is adaptively determined would increase the effectiveness of their 
system by allowing determination of the IP address in order to filter unwanted e-mails based on 
sender information. 

32. As per claim 20, Kirsch and Wang teach the invention substantially as claimed in claim 1 
above. Kirsch and Wang do not specifically teach a spam rate. Murray teaches determining a 
spam rate (col. 10, lines 53-65). 

33. It would have been obvious to one having ordinary skill in the art at the time of the 
invention was made to combine the teachings of Kirsch, Wang and Murray because Murray's 
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teaching of determining a spam rate would increase the effectiveness of their system by allowing 
identification of unwanted e-mails based on spam rate. 

34. As per claim 21, Kirsch and Wang teach the invention substantially as claimed in claim 1 
above. Kirsch and Wang do not specifically teach a spam rate. Murray teaches determining an 
estimated instantaneous spam rate (col. 10, lines 53-65; col. 11, lines 24-27). 

35. It would have been obvious to one having ordinary skill in the art at the time of the 
invention was made to combine the teachings of Kirsch, Wang and Murray because Murray's 
teaching of determining a spam rate would increase the effectiveness of their system by allowing 
identification of unwanted e-mails based on spam rate. 

36. As per claim 23, Kirsch and Wang teach the invention substantially as claimed in claim 1 
above. Kirsch and Wang do not teach giving a classification weight relative to another 
classification. Murray teaches wherein classifying the received message includes giving a 
classification variable greater weight relative to another classification variable (col. 9, lines 20- 
31). 



37. It would have been obvious to one having ordinary skill in the art at the time of the 
invention was made to combine the teachings of Kirsch, Wang and Murray because Murray's 
teaching of giving a classification greater weight relative to another classification would increase 



Application/Control Number: 10/776,677 Page 14 

Art Unit: 2453 

the effectiveness of their system by allowing unwanted e-mails to be accurately identified based 
on sender's reputation. 

38. As per claim 24, Kirsch and Wang teach the invention substantially as claimed in claim 1 
above. Kirsch and Wang do not teach giving a classification weight relative to a computer 
classification. Murray teaches wherein classifying the received message includes giving a 
classification variable associated with user greater weight relative to a classification variable 
associated with computer classification (col. 8, lines 44-50; col. 9, lines 20-31). 

39. It would have been obvious to one having ordinary skill in the art at the time of the 
invention was made to combine the teachings of Kirsch, Wang and Murray because Murray's 
teaching of giving a classification greater weight relative to a computer classification would 
increase the effectiveness of their system by allowing unwanted e-mails to be accurately 
identified based on complied sender's reputation. 

40. As per claim 25, Kirsch and Wang teach the invention substantially as claimed in claim 1 
above. Kirsch and Wang do not teach giving weight of a good classification. Murray teaches 
wherein classifying the received message includes giving an indeterminate classification a 
fraction of the weight of a good classification (col. 9, lines 20-31). 

41 . It would have been obvious to one having ordinary skill in the art at the time of the 
invention was made to combine the teachings of Kirsch, Wang and Murray because Murray's 
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teaching of giving weight to a good classification would increase the effectiveness of their 
system by allowing unwanted e-mails to be accurately identified based on sender's good 
reputation. 

42. As per claims 26 and 27, Kirsch and Wang teach the invention substantially as claimed in 
claim 1 above. Although Kirsch teaches the reputation table (col. 3, lines 7-13; col. 9, lines 20- 
31), however, Kirsch and Wang do not specifically teach the table indexed by IP address and 
domain. Murray teaches wherein the table is indexed by IP address and domain wherein each 
cell includes information about previous classifications (col. 9, lines 32-40). 

43. It would have been obvious to one having ordinary skill in the art at the time of the 
invention was made to combine the teachings of Kirsch, Wang and Murray because Murray's 
teaching of consulting a table of IP address and domain would increase the effectiveness of their 
system by allowing unwanted e-mails to be accurately identified based on sender's information. 

44. Claim 29 is rejected under 35 U.S.C. 103(a) as being unpatentable over Kirsch and Wang 
as applied to claim 1 above, and further in view of Appleman, U.S. Patent Application 
Publication 2005/0076240 (hereinafter Appleman). 

45. As per claim 29, Kirsch and Wang teach the invention substantially as claimed in claim 1 
above. Kirsch and Wang do not specifically teach a Bayesian classifier. Appleman teach 
wherein the other classifier is a Bayesian classifier ([0058]). 
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46. It would have been obvious to one having ordinary skill in the art at the time of the 
invention was made to combine the teachings of Kirsch, Wang and Appleman because 
Appleman's teaching of providing the IP address and domain classification as input to a 
Bayesian classifier would increase the effectiveness of their system by allowing unwanted e- 
mails to be accurately identified based on sender's information. 

(10) Response to Argument 

In the remarks, applicant argued that: 

(1) The prior arts of record fail to teach overriding the whitelist based 
on the score assigned to the address-domain pair, wherein the message is 
classified as spam even though the domain of the message appears on the 
whitelist. 

In response to point (1), Kirsch teaches if the sender is on the whitelist, the message is passed on 
to the recipient (for instance, placed in the recipient's inbox) (col. 5, lines 60-62). Kirsch teaches 
higher weight is given to manual (explicit) reversals of whitelist/blacklist status than implicit 
rankings (where, for instance, a sender is automatically placed on a whitelist because of the 
sender's reputation rather than a user explicitly placing the sender on the whitelist) (col. 18, lines 
38-43). This means there is two types of whitelist, an explicit whitelist and an implicit whitelist. 
Kirsch further teach the Inbox is periodically reevaluated to determine if the rating of any of 
senders of messages in the inbox has changed. If the sender's reputation is no longer "good" and 
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the sender has not been explicitly whitelisted by the recipient, the message can be removed to a 
spam folder and processed accordingly or deleted, depending on the rating and the recipient's 
settings (col. 19, lines 7-14). This means message of sender in the whitelist (message in the 
Inbox, i.e., implicit whitelist not explicitly whitelisted) can be changed to spam based on the 
calculated reputation of the sender from IP address and domain pair. Changing of messages to 
spam counteracts the normal operation of the implicit whitelist (i.e., overriding the whitelist 
based on score assigned to the address-domain pair) 

(11) Related Proceeding(s) Appendix 

No decision rendered by a court or the Board is identified by the examiner in the Related 
Appeals and Interferences section of this examiner's answer. 

For the above reasons, it is believed that the rejections should be sustained. 
Respectfully submitted, 
/Philip C Lee/ 

Primary Examiner, Art Unit 2453 

Conferees: 
/Krisna Lim/ 

Primary Examiner, Art Unit 2453 



/Krista M. Zele/ 

Supervisory Patent Examiner, Art Unit 2453 



